Switch from query-param (?exaApiKey=...) to Authorization: Bearer header
for Exa MCP authentication. The MCP SDK's SSE endpoint resolution discards
query parameters when the server replies with a relative path, causing
EXA_API_KEY to be silently lost and falling back to rate-limited free tier.
Bearer auth via header survives URL resolution and is consistent with the
Tavily MCP config pattern already in use.
Fixes#3763
Relands #4090 (CLA unsigned by original author)
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Minsoo Choi <Neo1228@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Previously, when websearch was configured with Tavily provider and the
TAVILY_API_KEY environment variable was not set, the entire plugin would
fail to load with no visible error to the user.
Changes:
1. createWebsearchConfig now returns undefined when Tavily key is missing
2. Added warning log: '[websearch] Tavily API key not found, skipping websearch MCP'
3. createBuiltinMcps now skips undefined configs instead of adding them
4. Added tests for both missing and present Tavily API key scenarios
Fixes#2996
Previously tests were tautological - they defined local logic
instead of invoking the actual implementation. Now all tests
properly exercise createWebsearchConfig.
YeonGyu-Kim